[Snort-users] stream5 issues

Keith keith at ...1935...
Mon Apr 7 12:01:08 EDT 2008


Hello,

If you are going to track TCP and or UDP you need to provide the 
configuration lines for those. even if the line is empty.
i.e.

preprocessor stream5_tcp: policy first, use_static_footprint_sizes
preprocessor stream5_udp:

or

preprocessor stream5_tcp:
preprocessor stream5_udp:

Hope that helps,
Keith

John Hally wrote:
> Hello all,
> 
> running into an issue that I'm stumped on.  when setting up stream5 I'm 
> getting the following:
> 
> snort[15925]: WARNING: Stream5 TCP default policy not specified in 
> configuration
> 
> snort[15925]: WARNING: Stream5 TCP misconfigured
> 
> snort[15925]: FATAL ERROR: Stream5 not properly configured... exiting
> 
> the problem is the stream5 setup is minimal:
> 
> preprocessor stream5_global: track_tcp yes, track_udp yes, track_icmp no
> 
> preprocessor stream5_udp: ignore_any_rules
> 
> preprocessor stream5_tcp: bind_to any, policy windows, detect_anomalies
> 
> 
> does anyone see anything wrong? 
> 
> thanks!
> 
> John.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
> Register now and save $200. Hurry, offer ends at 11:59 p.m., 
> Monday, April 7! Use priority code J8TLD2. 
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list